Internal server details (inbound decryption)

Network conditions and tunnel rules

Networks control or decrypt traffic based on its source and destination IP address, using inner headers. Tunnel rules, which use outer headers, have tunnel endpoint conditions instead of network conditions.

You can use predefined objects to build network conditions, or manually specify individual IP addresses or address blocks.

Minimize the number of matching criteria, particularly for security zones, network objects, and port objects. When you specify multiple criteria, the system must match against each combination of the specified criteria.

Behaviour of Decrypt - Replace Cert rules

When using the Decrypt – Replace Cert action in an inbound decryption policy, the firewall enforces strict validation of the internal server’s certificate against the Trusted CA list defined within the policy. If the certificate fails validation, the firewall does not decrypt the traffic. Decryption fails if the certificate exhibits any of these conditions:

• Expired or Not-Yet-Valid: The current system time is outside the certificate's validity period.

• Untrusted: The signing Certificate Authority (CA) is not present in the Trusted CA list.

• Invalid Signature: The digital signature cannot be verified.

• Revoked or Invalid CRL: The certificate has been revoked, or the Certificate Revocation List (CRL) is invalid or unreachable.

In a new standard decryption policy, the system generates an inbound SSL rule with the Server Certificate Status condition set to Valid.

If a server presents a certificate that does not meet these validation criteria, it fails to match the rule and is handled by the default Do Not Decrypt (DND) rule. This DND action is the default behavior for standard mode policies and is not configurable.

You can override the validation using the Decrypt – Known key. Refer to Override internal server validation.